A joint study by AppSec Solutions and the ARPP Domestic Software association, covering over 50 companies, reveals that all surveyed organizations have integrated AI into their business processes. Despite this widespread adoption, only 23% of companies have implemented basic AI security control systems.
The research highlights that 81% of companies use large language models, 72% utilize AI code assistants, 61% employ local language models, 57% use RAG systems, and 44% rely on ML models. Additionally, 72% of respondents have integrated AI agents into their corporate infrastructure, delegating various tasks to these systems.
Security risks are exacerbated by the use of external AI services, with 41% of companies reporting mass usage by employees. Experts note that these interactions often function as shadow AI, bypassing corporate control and leading to potential leaks of sensitive data. Only 4% of companies reported confirmed attacks, yet over 90% have never conducted a formal threat assessment.
The study indicates that the speed of AI adoption in Russian software development is three times faster than the implementation of security measures. Experts suggest that organizations currently lack the expertise and processes to manage AI-related risks, such as prompt injections and supply chain attacks, effectively.
To address these challenges, industry representatives point to the FSTEC Order 117 and the 2026 methodology as frameworks for security. Experts recommend deploying AI security gateways and centralized risk management platforms to distinguish between normal model operations and potential malicious activity.
